KR20010107572A - Trust-based link access control - Google Patents

Abstract

The present invention relates to an apparatus for controlling such linked documents on a computer based on a calculated determination as to the reliability of linked documents, such that a user does not navigate from a document that is linking an untrusted document to such an untrusted document; Provide program products and methods. Known link access control on the reliability of a document allows the owner, author, developer, or publisher of the document to avoid potential difficulties, such as loss of confusion, confusion, or liability as a result of the content of the linked document under the control of a third party. .

Description

Reliability-based link access control method, device and program product {TRUST-BASED LINK ACCESS CONTROL}

The present invention relates generally to computers and computer software. In particular, the present invention relates to access control of documents stored in a computer.

The amount and variety of information that can be accessed through computers is increasing at an alarming rate. In particular, the Internet has allowed computer users to access a wide variety of information from other computers around the world.

Most of the information accessible through the Internet is organized in hypertext documents. This hypertext document is typically a document formatted in a language called hypertext markup language (HTML), and is accessed through a segment of the Internet called the World Wide Web. Typically, a hypertext document is embedded with one or more "hypertext links" that the end user can choose to jump to another document or jump to another place within the same document. Normally, each hypertext document is identified by a storage place (called a constant resource indicator (URL)) that stores the document and has a hypertext link to a specific document, that is, a "target." The hypertext link designates the storage location of the document, so when the link is selected, the document can be called.

Hypertext documents can incorporate a wide variety of other information, such as text, graphics, video, sound, and animation, and furthermore, these documents are typically maintained as a single entity and have consistently related several documents. It can be organized in a collection of "sites". In addition, due to the considerable popularity of the World Wide Web, many private computer networks currently support hypertext documents as many as existing operating systems and computer software applications.

Typically, to navigate hypertext documents and their lines, a computer program, commonly referred to as a browser, is used. In the case of a browser, an end user may use a mouse or pointing device to take a link, such as highlighted text, an image, or other user interface component (e.g., a button) on the document, and then click it to select another document, You can sail to another place.

If any hypertext document can link to that document with access to a given computer simply by including the appropriate URL or any other storage identifier of any other document, the user can be very flexible and intuitive There are many times you can sail. Thus, linking documents on the Internet freely and centrally, the interface is powerful and useful, through which the user can find the information of interest by simply tracking the links until the desired information is found.

The nature of the Internet, which is not centralized and uncontrolled, however, does not exist without its shortcomings. In particular, documents under the control of certain entities, such as the publisher, owner or author, often link to documents under the control of a third party. Nevertheless, by linking to a third party document, it can be recognized that the entities somehow support or otherwise support the content of the third party document.

As an example, an owner of a website based on religion may link to another website that believes in similar religious teachings. However, the owner may have no control over the content of that other website, and as a result may be changed to any other website that contains teachings that are inappropriate or offensive to the owner and his followers. The owner may not want the reader of the other web site to think that the owner supports or supports the content of the modified web site.

As another example, a web site handling legal, technical or medical information may link to a third party web site to provide additional resources of similar information. However, if changes in law, technology and medical science are rapid and ongoing, linking to such third party websites that are not kept up to date sufficiently is a major concern. It would be extremely undesirable to link an informational web site to a third party web site that contains inaccurate or outdated information. In addition to potential failures and loss of credit, links to inaccurate information can, in extreme cases, raise the possibility of legal liability.

Document owners, publishers, and developers have traditionally attempted to avoid links to untrustworthy third party documents by periodically monitoring linked documents and websites. However, monitoring such documents and web sites is relatively time consuming because it is often necessary to read and analyze them manually to determine whether the contents of the document are acceptable. As a result, monitoring is often sparse, and the owner, publisher, and developer of a document is at risk of unreliable such documents between successive checks of third-party documents.

Therefore, there is a considerable technical need for a method of limiting the risks associated with links to third party documents whose contents cannot be controlled, in particular to minimize the likelihood of misleading or supporting the content of third party documents.

The present invention relates to the above and other problems associated with the prior art, based on a calculated judgment on the reliability of linked documents, to prevent a user from navigating from a document linking an untrusted document to such an untrusted document. , An apparatus, a program product and a method for controlling such linked documents on a computer. In another advantage, by known link access control on the reliability of a document, the owner, author, developer, or publisher of the document may have potential difficulties such as loss, confusion, or liability as a result of the content of the linked document under the control of a third party. Can be avoided.

In connection with one aspect of the present invention, document access on a computer includes at least a portion of the first document on a computer display, when the first document includes a link for use in navigating the second document. Controlled by allowing display. If the user determines whether the second document is reliable before attempting to navigate to the second document through the link of the first document, and if the second document is unreliable, then the user can determine the link of the first document. Cannot navigate to the second document.

These and other advantages and features that characterize the invention are claimed in the claims appended hereto and form other parts thereof. However, in order to better understand the present invention and the advantages and objects obtained through the use of the present invention, the reference numerals described in the exemplary embodiments of the present invention are indicated in the drawings and the descriptions thereof.

1 is a block diagram of a computer system suitable for the present invention.

2 is a block diagram of an exemplary hardware and software environment of a computer of the computer system of FIG.

3 is a flow chart illustrating a main routine executed by the browser of FIG.

4 is an exemplary HTML syntax for a trusted link tag suitable for the present invention.

5 is an exemplary HTML syntax for a trust exclusion tag suitable for the present invention.

6 is a flowchart for explaining a document display routine cited in FIG.

FIG. 7 is a flowchart for explaining a link test routine cited in FIGS. 3 and 6;

8 is a flowchart for explaining a reliability depth processing routine recited in FIG.

9 is a flowchart for explaining a CRC calculation routine recited in FIG.

<Description of Symbols Used in Drawings>

10: computer system

12, 14, 20: client computer

16: server

18: network

22: computer display

23: storage device

24: printer

26: mouse

27: keyboard

30: device or computer

31: Processor

32: memory

33: user input device

34: display

35: mass storage

36: network

38: operating system

40: browser

The embodiments described below can be used to minimize the risks associated with linking to third party documents by analyzing and monitoring the reliability of the linked document before the user attempts to navigate from the source document to the linked document. In the described embodiment, each document is identified by a storage location where the document is stored, and links formed between the documents identify storage locations of linked documents. The storage location may be the file name and / or path of a particular document or file stored in a workstation or other single user computer, such as stored therein. In another example, the storage location may be outside of a workstation stored on a network server, for example, via a private LAN or WAN, or via a public network such as the Internet. Likewise, the storage location can be identified by an address in the form of a constant resource indicator (URL), a format well known in the art. However, it should be appreciated that the present invention can also be used for connections with other storage location identification formats.

In addition, in the illustrated embodiment, the document is formatted in Hypertext Markup Language (HTML), which is an excellent format used for Internet documents. However, it is to be understood that the present invention can be used in other document formats and other file formats, including text and non-text documents, files, database records, and the like, which are collectively referred to herein as &quot; documents. &Quot; In this specification, a subset of documents is referred to as a third party document. Provided that the content of such documents is controlled by entities other than the entity controlling any document that links to such third party documents.

As will be discussed in more detail below, "reliability" for a given document is any arbitrary or totally inferring degree of confidence that the reliability of a particular document still contains acceptable content since the last time it was positively demonstrated. It is determined based on a matrix of the number of.

One method of determining the reliability of a document is based on detected changes in the document content, for example by comparing the current content of the document with the known latest content of the document. Such a comparison can be performed, for example, via direct comparison or estimated through checksums, timestamps, and the like.

Another method of determining the reliability of a particular document is based on detected changes in the content of one or more documents linked directly or indirectly to that document. Moreover, in some cases where the content of the document is being analyzed for changes, any portion of the document may be removed from the analysis so that, for example, changes in the document that may indicate a lack of confidence may be limited to selecting passages within the document. It will be understood that it is expressly included or excluded.

Another method of determining reliability is based on the amount of time since it has recently been proven reliable. Those skilled in the art, having read the subject matter of the present invention, will understand that other methods of determining the reliability of documents may be used in other ways.

Before describing particular embodiments of the present invention, the gist of an exemplary hardware and software environment for use in the present invention is described.

Hardware and Software Environment

In the drawings, like reference numerals used in some drawings indicate like parts. 1 shows a computer system 10 suitable for the present invention. Computer system 10 includes one or more client computers 12, 14, and 20 (e.g., desktop or PC-type computers, workstations, and the like) via server 18 (e.g., PC-type servers, Networked computer systems coupled to microcomputers, medium computers, large computers, and the like. The network 18 may actually provide all forms of networked interconnection, including, but not limited to, regional networks, wide area networks, wireless networks, and public networks (eg, the Internet). Moreover, any number of computers and other devices can be connected to the network via a network 18, such as multiple servers.

The client computer 20, similar to the computers 12 and 14, may include, among other devices, a central processing unit (CPU) 21, a plurality of peripheral devices such as the computer display 22, a storage device 23, a printer ( 24) and various input devices (eg, mouse 26 and keyboard 27). Server computer 16 typically has more processing power and storage capacity, but may be configured similarly to those known in the art.

2 illustrates another example hardware and software environment for an apparatus 30 suitable for the present invention. For purposes of the present invention, the device 30 is a client computer (eg, similar to the computers 12, 14, and 20 of FIG. 1), a server computer (eg, similar to the server 16 of FIG. 1), portable Any type of computer, computer system, or other programmable electronic device can actually be provided, including computers, handheld computers, embedded controllers, and the like. The device 30 may be combined as shown in FIG. 1 or alternatively may be a stand alone device. The term &quot; device &quot; may include other suitable programmable electronic devices suitable for the present invention, but hereinafter, the device 30 is also referred to as a &quot; computer. &Quot;

Typically, computer 30 includes at least one processor 31 coupled to memory 32. Processor 31 includes one or more processors (e.g., microprocessors), and memory 32 includes random access memory (RAM) devices that make up a main memory of computer 30, such as cache memory, non-volatile Or auxiliary memory such as backup memory (eg, programmable or flash memory), read-only memory, and the like. Moreover, the memory 32 is a memory store physically located elsewhere in the computer 30, such as some cache memory of the processor 31, and as a virtual memory, for example, the mass storage device 35 or the network 36. It can be seen that it includes any storage capacity used as stored on another computer coupled to the computer 30 via.

Also, the computer 30 typically receives a plurality of inputs and outputs for communicating information with the outside. For interface with a user or operator, computer 30 typically displays a display with one or more user input devices 33 (eg, keyboard, mouse, trackball, joystick, touchpad and / or microphone, among other devices). 34 (eg, CRT monitor, LCD display panel and / or speaker, among other devices).

In addition, for additional storage, computer 30 may include one or more mass storage devices 35, such as a floppy or other removable disk drive, hard disk drive, direct access storage device (DASD), optical, among other devices. Drives (eg, CD drives, DVD drives, etc.) and / or tape drives. Moreover, computer 30 includes an interface with one or more networks 36 (eg, LAN, WAN, wireless network and / or the Internet, among other networks) to communicate information with other computers coupled to the network. can do. Computer 30 typically includes a suitable analog and / or digital interface between processor 31 and each component 32, 33, 34, 35, and 36, as is known in the art.

The computer 30 operates under the control of the operating system 38 and executes or otherwise executes various computer software applications, components, programs, objects, modules, data structures, etc. (eg, the browser 40 among others). Depends on them. Moreover, various applications, components, programs, objects, modules, etc. may execute one or more processors within another computer coupled to the computer 30 via the network 36, such as in a distributed or client-server computing environment. Thereby, the processing required to implement the functionality of the computer program can be assigned to multiple computers on the network.

Generally, in this specification, a routine that is executed to implement embodiments of the present invention, whether implemented as part of an operating system or a sequence of special applications, components, programs, objects, modules, or instructions, is referred to as a "computer program. Or simply "program." Typically, a computer program resides many times in various memories and storage devices of a computer, and when the computer reads and executes by one or more processors, the computer executes steps or elements that embody various aspects of the present invention. One or more instructions to perform the steps necessary to perform. Moreover, although the present invention has a relationship that allows a computer and a computer system to fully function and is described below, those skilled in the art can distribute various embodiments of the present invention as various program products. It will be appreciated that the present invention applies equally regardless of the particular type of signal carrying medium used to actually perform the distribution. Examples of signal bearing media include, but are not limited to, recordable media such as volatile and nonvolatile memory devices, floppy and other removable disks, hard disk drives, magnetic tape, optical disks (eg, CD-ROM, DVD, etc.), There are transmission media such as, but not limited to, digital and analog communication links.

Moreover, the various programs described below can be identified based on the applications in which they are implemented in particular embodiments of the present invention. However, it should be understood that any particular program terminology described below is merely for convenience, and therefore the present invention should not be limited to use only in any particular application that is identified and / or implied by such term.

Those skilled in the art will appreciate that the exemplary environments shown in FIGS. 1 and 2 are not intended to limit the invention. Of course, those skilled in the art will recognize that other hardware and / or software environments may be used without departing from the scope of the present invention.

Reliability-based Link Access Control

Exemplary uses of the present invention in an Internet-based computing environment are described in detail below, in particular in the context of analyzing the reliability of an HTML compatible document from which a URL identifies and cites storage locations on the Internet or other forms of network. In an example use case, a reliability analysis of the document is performed on the client side, i.e., in the browser. However, in another use case, this analysis is performed on the server side such that the document is deformed and sent to the user with the reliability of the link in the appropriately deformed document. Thus, while the invention is described below in the context of a client-side browser application, the invention is not limited to this particular use case.

In particular, FIG. 3 shows the main routine 50 executed by the browser 40 of FIG. Upon startup of the browser, the main routine 50 performs routine initialization in block 52 that is known in the art. After initialization, the task driven loop begins at block 54. In that task driven loop, tasks directed to the web browser, such as user input, receipt of downloaded data, etc., are passed through the task protocol to the browser as is known in the art. In other examples, other programming models may be used.

Upon receipt of a predetermined task, control passes to blocks 56-60 to properly decrypt and process each task. Block 56 detects document display operations that may occur, for example, in response to a request to display a stored document, such as via display refresh or download of a new document. The document display job is handled by passing control to the document display routine 62, which will be described later in detail with respect to FIG.

Again in block 56, if the job is not a document display job, control passes to block 58 to determine whether the job is a link selection job. However, if the job is not a link selection job, control passes to block 60 to process the job as conventionally.

In block 58 again, the link selection operation is performed, for example, in the user selection of a hypertext link of the displayed document and in a direct input of selecting a linked image, selecting a bookmark, or entering a URL into the address bar, among other operations. Can be generated in response. In response to the link selection operation, control passes to block 64 to first determine whether the selected link is a reliable link. In the described use case, the determination of whether the link is a reliable link is performed by analyzing the HTML code of the document associated with the link to determine the extent to which the document has changed since the last time the document was found to be reliable.

4 illustrates one possible syntax for an anchor tag or a link tag, for example, used to represent a link in an HTML environment. The syntax shown in Figure 4 represents an extension of the HTML standard that includes a plurality of additional fields suitable for implementing a trusted link appropriately for the present invention.

For example, a conventional HTML anchor tag includes a place identifier represented by a URL included in an HREF field. Text that is displayed and provides a display representation of a user selectable link is usually woven between the start and end anchor tags in the formats "<A ...>" and "<\ A ...>". .

Conventional HTML anchor tags can be extended herein to support reliable links by incorporating one or more additional fields, with the fields beginning with "trust". One extension element is the TRUSTDATE field, which provides a timestamp (including time and / or date) to indicate the most recent time the document was determined to be reliable for comparison with the latest time the document was updated. do. Thus, if the update timestamp of the downloaded document is more recent than the timestamp stored in TRUSTDATE, it can be assumed that the document is no longer reliable.

Another extension element is the TRUSTCRC field, which provides a checksum, such as a cyclic redundancy checksum (CRC) value, which is used to indicate the content of a tagged document at a time when the document was recently recognized as reliable. However, other checksums and direct comparisons of the contents of the document or any portion thereof may be used in place of the CRC.

The TRUSTIMAGES field provides a flag indicating whether image data from the document should be included in any CRC calculation. The TRUSTDEPTH field specifies a plurality of levels (chains of links) below a specialized URL to check and include in the confidence determination for the linked document.

The TRUSTDOMAINONLY field provides a flag used in conjunction with TRUSTDEPTH to inform the web browser about whether the tag contains a link that is not in the same area as the targeted URL. By excluding links that are not in the same area, it can be foreseen that only links to documents within the same website will be analyzed for changes.

The TRUSTLIST field provides an alternative element in the TRUSTDEPTH field that allows the document author or certification authority to specify a list of URLs to be specifically included in determining whether a particular linked document is trustworthy. The TRUSTLIST field provides a list of URLs and associated CRCs and / or timestamps to be compared for each URL to determine if a document at any such URL has changed. In its replacement, the TRUSTLIST field provides a list of URLs to include in the group CRC calculation for the linked document.

The TRUSTDISPLAY field enables the selection of other restraining actions performed by the browser in response to the detection of an unreliable link. One possible indication of that field is link restraint expressed as a "no link" value, whereby the text of the link is displayed but the user cannot select the link. Another possible value is the "warning" value, whereby the user is warned via a dialog box or other user interface mechanism that the link being attempted to navigate is unreliable. Another possible value is represented by the "prevent" value, which warns the user that the link is unreliable and prevents him from navigating the linked document in response to user selection of the link.

As will be clearer below, additional restraining factors may be used. For example, an untrusted link may have a warning indicator or other form of highlighting associated therewith to indicate an untrusted state (and / or trusted state) of a link. For example, colors, icons, patterns, sounds, bubble text, etc. can be used to represent or highlight unreliable links. Any of these restraining operations may be used individually or in combination with others. Moreover, in addition to embedding these parameters inside the link tag, the selection of this restraining action may be selected by either the document author or the local user through local settings, cookies, or the like. The user settings may be changed locally upon entry of the appropriate delegation so that, for example, the parent may change the restraining operation performed for the children.

As shown in FIG. 5, an additional form of tag, referred to herein as a TRUSTEXCLUDE tag, may be used to obliterate areas of document content in response to the reliability of any number of listed links. As shown in Fig. 5, such a tag may include a URLLIST field, which URLLIST and associated CRC and / or URLs used to determine whether the link and its contents should be removed from the display representation of the document. Or provide a list of dates. Optionally, start and end TRUSTEXCLUDE tags are placed around the area of content to be displayed. In response to determining the trustworthiness for any of the listed URLs, the entire area is excluded from the display.

Moreover, in some embodiments, it may be desirable to embed an alternative content to be displayed in response to a confidence determination in the TRUSTEXCLUDE region. For example, a pair of alternate content tags, that is, "<CONTENTIFUNTRUSTED>" and "</ CONTENTIFUNTRUSTED>" may be a "<TRUSTEXCLUDE>" tag and a "</ TRUSTEXCLUDE>" that define a TRUSTEXCLUDE area to define the range of alternative content to be displayed. It can be placed between tags. Alternatively, the ALTSRC field can be used in a similar way as the HTML <LAYER> tag is used, or the TRUSTEXCLUDE area is queried using the built-in script to determine whether the TRUSTEXCLUDE area should be displayed or a specific layer should be visible. I can receive it.

Any of the above fields may be used separately or in combination with other fields. In addition, it will be appreciated that in non-HTML environments, other ways of expressing both the TRUSTEXCLUDE region and reliable link parameter information may alternatively be used. Selection of such alternative data storage formats will be well within the capability of one of ordinary skill in the art to which this specification is directed.

Returning to FIG. 3, the determination of whether the link is a reliable link at block 64 can be performed in a number of ways, for example, by detecting any of the augmented fields mentioned in connection with FIG. 4. . If it is determined that a link is not a reliable link, control passes to block 66 to navigate the link in a conventional manner. However, if it is determined that the link is a reliable link, control passes from block 64 to block 68 and calls a link check routine to determine whether the link is reliable. If it is determined that the link is reliable, control passes directly to block 66 to navigate the link. Moreover, in some embodiments, prior to passing control to block 66, it is desirable to indicate that the link is a trusted link and / or that the link has been verified to be reliable.

However, if it is recognized that the link is not reliable, control passes to block 70 and the TRUSTDISPLAY field associated with the link is set to "warning". If so, then control passes to block 72 to display a warning dialog to the user and to pass control to block 66 to navigate the link.

Typically, the display of the warning may be in the form of a dialog box that must be exited before the link can be navigated. Moreover, it is desirable to allow the user to cancel navigation to the link when displaying the warning.

Returning to block 70 again, unless the TRUSTDISPLAY field is set to "warning", it is not possible in the main routine as described herein for the link to be activated when the "no link" value is set for the TRUSTDISPLAY field. It is assumed that the TRUSTDISPLAY field, which is unlikely, is set to "prevent" (this will be clearer from the discussion below with respect to FIG. 6). As such, control passes to block 70 to notify the user that the link is not allowed. Navigation to the link is made more impossible by bypassing block 66 and immediately returning to block 54. In other embodiments, there may be no prior notification to the user. That is, only navigation on the link may be impossible.

6 illustrates the document display routine 62 in more detail. The routine 62 begins at block 80 by scanning a document to process all TRUSTEXCLUDE sections defined therein. The TRUSTEXCLUDE section is defined by a start tag and end tag having the format described above with respect to FIG. 5. For each of these sections, control passes to block 82 to process all entries in the URLIST field provided within that block. For each such entry, control passes to block 84 and checks the CRC or date (provided in URLLIST) for the CRC or date of the current version of the document stored at the URL specified in that entry. Typically, block 84 implies at least a timestamp or CRC, or a search of the entire document for URLs provided in the list. Based on this check, block 86 determines whether the document has changed. If not, control passes to block 82 to process the next entry in the URLLIST. However, if it is determined that the document has been changed, control passes to block 88 to remove the section between the TRUSTEXCLUDE tags among the allowed pages, for example by deleting the document content associated with that section in the temporary version of the HTML source document, or If there is other content in the TRUSTEXCLUDE tag, it is excluded by modifying the document content to display such other content instead of the excluded content. At the end of block 88, control passes to block 80 to process additional TRUSTEXCLUDE sections in the document.

If all TRUSTEXCLUDE sections in the document have been processed, control passes to block 90 to process all anchor tags in the document. For each such anchor tag, control passes to block 92 to determine whether the anchor tag is a reliable link. If not, control returns to block 90 to process the next anchor tag.

However, if the link is a trusted link, control passes to block 68 to call the link check routine, thereby determining whether the document referenced by the link has changed, and thus determined to be reliable.

If the link check routine returns a "pass" result, control returns to block 90 to process the additional anchor tag. However, if the link check routine returns a "failure" result, control passes to block 94 to determine whether the TRUSTDIPLAY field is a "no link" value. If not, control passes to block 95 to optionally add a warning indicator to the link display beacon, such as a unique color, icon, etc. to indicate to the user that the link is unreliable. Control then returns to block 90.

Returning to block 94, if the TRUSTDISPLAY field is set to "no link", control passes to block 96 to disable the link, but between the starting anchor tag and the ending anchor tag for a reliable link. Contains the linked text. Disabling a link is typically performed by removing the anchor tag from the temporary version of the document and leaving the linked text in between in the document.

Returning to block 90, if all anchor tags have been processed, control passes to block 98, where any excluded sections and anchor tags with remaining document content, i.e., with respect to unreliable links that have been removed or omitted appropriately, are passed. Represents a page with Representing a page based on HTML-based content is an operation known in the art, and this operation is not described in more detail herein. At the end of the page representation, the routine 62 ends.

7 illustrates the link check routine 68 in more detail. The routine 68 begins at block 100 by determining whether the TRUSTLIST field is specified for a trusted link. If so, then control passes to block 102 and examines each URL in the list to determine which linked document in the list has changed, such as by analyzing the CRC or timestamp specified in the URLLIST.

Block 104 then determines whether any of the documents referred to in this way have changed, and, based on the results, returns either a "failure" or "pass" indication at the end of the routine.

Returning to block 100, if the TRUSTLIST field is not specified, control passes to block 106 to determine if the TRUSTDEPTH value is specified, i.e. whether there is a non-zero value in the TRUSTDEPTH field in the trusted link tag. Determine whether or not. If not, block 108 examines only the document referenced in the trusted link to determine if the document has been modified and therefore unreliable. Control then passes to block 110, determines whether the URL has changed, and returns either a "fail" or "pass" result based on the document's change status.

Returning to block 106, if a TRUSTDEPTH value is specified, control passes to the reliability depth processing routine 112, which returns either a "pass" or "fail" result to the routine as a response to the link check operation. 68 goes to the calling routine.

8 describes the reliability depth processing routine 112 in more detail. This routine operates by invoking the CRC calculation routine 120 to pass the URL specified in the anchor tag and the current depth specified in the anchor tag as input to the routine. The result returned by the routine 120 is a CRC, which implies the CRC of the current document and any child documents based on the settings specified in the anchor tag, as described in more detail below. Based on this calculated CRC, block 122 compares the calculated CRC with that specified in the TRUSTCRC field of the anchor tag, returns a "pass" value if the CRC matches, and returns a "fail" if it does not match. send.

9 illustrates CRC calculation routine 120 in more detail, which acts as a recursive routine to process each link formed in a tree of links coming from the linked document referenced in the anchor tag. The routine 120 begins at block 130 by calculating a CRC for the document referenced in the input URL for the routine. The local variable called SAVED CRC is initialized by the CRC value calculated at block 132. Next, block 134 determines whether the depth variable provided to the routine as an input is greater than zero. If so, then control passes to block 136 to process each link in the document referenced in the input URL.

For each such link, control passes to block 138 to determine whether the TRUSTDOMAINONLY flag for the anchor is set, so that only URLs from the same domain as the primary URL from the anchor tag should be embedded in the CRC calculation. Is displayed.

First, assuming that no flag is set, control passes to block 120 to call the CRC calculation routine 120 recursively, with the URL specified for the link currently being processed and the depth for the routine 120. Provide a value less than 1 as the input to the recursive function call. At the end of the recursive call, control passes to block 140 and appends the CRC returned from the function call to the local SAVED CRC value initialized at block 132. Control then returns to block 136 to process each additional link in the document. If all these links have been processed, control passes to block 144 to return the SAVED CRC value as a result of the routine. Returning to block 138 again, if the TRUSTDOMAINONLY flag is set, control passes to block 142 to determine whether the domain for the link currently being processed is equal to that specified in the anchor. If not, control returns to block 136 to process the next link in the document. However, if the domains match, control passes to block 120 to call the CRC calculation routine cyclically.

Then, returning to block 134, if the depth input to the CRC calculation routine is not greater than zero, the CRC for the document itself is returned by passing control directly to block 144. As such, the result of the recursive call to the routine 120 is the CRC for each document linked within the selected depth in the overall calculation of the CRC for the document referenced in the anchor tag.

Another method of CRC calculation for a tree of documents may be used in the alternatives. For example, it is desirable to examine each link processed by the CRC calculation routine, determine whether the link has already been processed during the current CRC calculation, discard the link, and return a value of zero from the example of the associated CRC calculation routine. can do. Doing so will prevent multiple links to the same document from being counted multiple times.

As noted above, an optional TRUSTIMAGES field may be embedded in the trusted link to indicate whether image data should be embedded in the CRC decision. As such, the CRCTESTs performed in blocks 84, 102, 108, and 130 of FIGS. 6, 7, and 9 may collectively imply or exclude image data based on the results of the anchor tag content. Moreover, in order to specifically include or exclude part of a particular document, similar algorithms may be used, for example, only the areas considered to be important may be embedded in the CRC calculation. In another alternative, other methods of modifying the CRC based on the type of data may also be used.

Various modifications may be made to the embodiments to be described without departing from the spirit and scope of the invention. For example, different levels of trust can be defined to a user to distinguish between them based on changes in one document, changes in documents referenced by that document, termination of one document's expiration, changes in specific areas of a document, and so on. Can be reported. Moreover, the determination of determining whether the document is reliable based on the CRC or data may be selectable based on the user setting.

It will also be appreciated that some form of verification processing may be supported on the server side with respect to the author or publisher of a particular document that contains trusted links. For example, an automated system may be provided in which the author or publisher analyzes the link and updates the CRC, date, or other parameters within that link, the automation system being within the scope of the capabilities of one of those skilled in the art to which this disclosure is directed. Will be in.

Furthermore, reliability can be obtained based on the expiration of the document, ie by comparing the timestamp of the TRUSTDATE field with the current time rather than the timestamp of the previous version of the document. It is also desirable to provide reliable control through bookmarks and to indicate the reliability of the document with respect to the selection of the bookmarked document. In addition, as discussed above, reliability audits are performed prior to serving the document to the user so that untrusted links are simply passed through to the user as disabled or deleted links within the HTML text, without modifying the conventional browser. It is desirable to be able to view documents that have been processed together. In addition, the functions described above may be implemented by the use of plug-ins, or by embedded scripts or other downloadable executable programs. It will also be appreciated that the checking of reliability may be performed in background processing prior to or during display of the document and before the user actually attempts to navigate to the document referenced by the trusted link.

Other variations will be apparent to those skilled in the art. Therefore, this invention is as it is in a claim.

Claims (32)

A method of controlling access to linked documents from your computer. (a) allowing at least a portion of the first document to be displayed on a computer display including a link for use in navigating the second document; (b) determining whether the second document is reliable before the user attempts to navigate the second document through a link in the first document; (c) if it is determined that the second document is not reliable, blocking a user from navigating the second document through the link in the first document. . The method of claim 1, wherein the determining step of determining whether the second document is reliable comprises determining whether the second document has been changed since the second document was finally determined to be reliable. How to do. 3. The method of claim 2 wherein the determining step of determining whether the second document has changed comprises comparing a current checksum for a current copy of the second document with a checksum for its previous copy. Way. The method of claim 2, wherein the determining step of determining whether the second document has been changed comprises: recently determining that the second document is reliable, a first timestamp indicating when the second document has been recently changed. Comparing the second timestamp to indicate when it was done. The method of claim 1, wherein the determining step of determining whether the second document is reliable comprises determining whether any additional documents referenced by links in the second document have been changed. Way to be. 6. The method of claim 5, wherein the determining step of determining whether any additional document referenced by the link in the second document has changed comprises determining whether the document within a predetermined link depth has changed. How to do. The determining step according to claim 5, wherein the determining step of determining whether any additional documents referred to by the link in the second document has changed, determines whether any documents included in the predetermined document list have changed. And a step. The method of claim 1, wherein the determining step of determining whether the second document is reliable and the blocking step of blocking a user from navigating the second document are performed such that the first document is transmitted to the user's computer. The method carried out previously. The method of claim 1, wherein the determining step of determining whether the second document is reliable and the blocking step of blocking a user from navigating the second document are performed by the first document being transmitted to the user's computer. And before the first document is displayed on the computer display. The method of claim 1, wherein the first document and the second document are under the control of an independent entity. The method of claim 1, wherein the blocking step of blocking a user from navigating the second document includes omitting the display of the link among the allowed portions of the first document. 12. The method according to claim 11, wherein the omission step of omitting the display of the link among the allowed portions of the first document includes omitting the display of additional document content adjacently arranged with links in the first document. Way to be. 13. The method of claim 12, wherein the additional document content is delimited by excluding a tag in the first document. The method of claim 1, wherein said blocking said user from navigating said second document comprises disabling said link. The method of claim 1, wherein the blocking step of preventing a user from navigating the second document includes highlighting a display mark of the link to indicate that the second document is not reliable. The method of claim 1, wherein the blocking step of blocking the user from navigating the second document comprises displaying a warning in response to the user attempting to navigate the second document. (a) a memory residing therein at least a portion of the first document for use in navigating the second document; (b) determine whether the second document is reliable before the user attempts to navigate the second document via a link in the first document, and if the second document is unreliable, the user And a program configured to permit at least a portion of the first document on a computer display to block navigation of the second document through the link in the first document. 18. The method of claim 17, wherein the program is configured to determine whether the second document is reliable by determining whether the second document has been changed since it was recently determined that the second document was reliable. Device. 18. The apparatus of claim 17, wherein the program is configured to determine whether the second document is reliable by determining whether any additional documents referenced by links in the second document have changed. 20. The apparatus of claim 19, wherein the program is configured to determine whether any additional documents referenced by links in the second document have changed by determining whether documents within a predetermined link depth have changed. Device. 20. The apparatus of claim 19, wherein the program is configured to determine whether any additional documents referenced by links in the second document have been changed by determining whether any documents included in a predetermined document list have changed. Device. 18. The apparatus of claim 17, wherein the program is configured to determine whether the second document is reliable and block the user from navigating the second document before the first document is transmitted to the user's computer. Device. 18. The apparatus of claim 17, wherein the program determines whether the second document is reliable after the first document is transferred to the user's computer and before the first document is displayed on the computer display. And prevent the user from navigating the second document. 18. The apparatus of claim 17, wherein the first document and the second document are under the control of an independent entity. 18. The apparatus of claim 17, wherein the program is configured to block a user from navigating the second document by omitting the display of the link among the allowed portions of the first document. 27. The apparatus of claim 25, wherein the program is configured to omit the display of the link among the allowed portions of the first document by omitting the display of additional document content that has adjacently placed links in the first document. . 27. The apparatus of claim 26, wherein the additional document content is delimited by excluding a tag in the first document. 18. The apparatus of claim 17, wherein the program is configured to block a user from navigating the second document by disabling the link. 18. The apparatus of claim 17, wherein the program is configured to block a user from navigating the second document by highlighting a display mark of the link to indicate that the second document is unreliable. 18. The apparatus of claim 17, wherein the program is configured to block the user from navigating the second document by displaying a warning in response to the user attempting to navigate the second document. (a) determining whether the second document is reliable before the user attempts to navigate the second document through a link in the first document, and if the second document is unreliable, the user To allow at least a portion of the first document on the computer display including a link for use in navigating the second document to block navigation of the second document through the link in the first document. Program, (b) A program product for obtaining a signal carrying medium on which the program is mounted. 32. The program product of claim 31, wherein the signal bearing medium comprises at least one of a recordable medium and a transmission medium.